Or sign each release with a private key on a machine that's "very protected from the Internet" and only have the Electron app automatically pull the update if t

Or sign each release with a private key on a machine that's "very protected from the Internet" and only have the Electron app automatically pull the update if the signature can be verified with the public key. Note that the public key should also not be on the web server (try Keybase ... if you don't have it I'll send you an invite). EDIT: Oops ... see the comment below as apparently Electron supports code signing via certificates.